Created attachment 633588 [details] [diff] [review]
The problem is that we call script->ensureHasTypes at the top of JSScript::ensureRanAnalysis. A little later, we call something that expects script->types to be non-NULL. If we GC in the middle, we get failures. I found this while running with GC zeal.
This may or may not be the right fix, but it worked for me.